11053 matches found
guava: local information disclosure via temporary directory created with unsafe permissions
A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure...
欣学英资讯 webopac7 代码问题漏洞
XinXueYing Info Webopac7 is an online public access catalog of China XinXueYing Info. It is used by users to access library services over the Internet. A code issue exists in XinXueYing Information Webopac7, which is caused by the file upload function not being able to filter special characters. ...
CVE-2021-38972
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly...
CentOS 8 : python27:2.7 (CESA-2021:4151)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4151 advisory. - python: Unsafe use of eval on data retrieved via HTTP in the test suite CVE-2020-27619 - python-jinja2: ReDoS vulnerability in the urlize filter...
RHEL 8 : python38:3.8 and python38-devel:3.8 (RHSA-2021:4162)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4162 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...
Zoom 多款产品输入验证错误漏洞
ZOOM Zoom Call Recording is a scalable session recording management solution.ZOOM on-premise Meeting Connector is a meeting connector.Zoom On- Premise Meeting Connector Controller and others are products of Zoom USA.Zoom On-Premise Meeting Connector Controller is an on-premise meeting connector. ...
CVE-2021-38973
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly...
CentOS 8 : python38:3.8 and python38-devel:3.8 (CESA-2021:4162)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4162 advisory. - python-psutil: Double free because of refcount mishandling CVE-2019-18874 - python: Unsafe use of eval on data retrieved via HTTP in the test suite...
python: Unsafe use of eval() on data retrieved via HTTP in the test suite
In Python3's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP...
python: Unsafe use of eval() on data retrieved via HTTP in the test suite
In Python3's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP...
python-pillow: Excessive memory allocation in BLP image reader
A flaw was found in python-pillow. Attackers can cause a denial of service memory consumption because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large...
Oppia 输入验证错误漏洞
Oppia is an online learning tool. Used to easily create and share interactive activities. A security vulnerability exists in versions prior to Oppia 3.1.4 that stems from the application not validating certain URLs before navigating to them...
PYSEC-2021-815
TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding...
Security Bulletin: IBM Security Guardium is affected by a jackson-databind vulnerability
Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2020-36185 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization between gadgets and typing, related to...
OESA-2021-1415 storm security update
Apache Storm realtime computation system Security Fixes: An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution RCE. Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x...
Exploit for Injection in Thedaylightstudio Fuel_Cms
Fuel CMS 1.4.1 - Remote Code Execution FUEL CMS 1.4.1 allows...
ASB-A-173025705
In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to local escalation of privilege that allows actions performed as the System UI with User execution privileges needed. User interaction is not needed for...
Generated code can read and write out of bounds in safe code
Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. For example, if generated code is used to decode malformed or untrusted input, undefined behavior and thus security vulnerabilities is possible even without...
Remote Code Execution (RCE)
Storm core is vulnerable to remote code execution RCE attacks. Vulnerable getGroupsCommand function is subject to unsafe deserialization, allowing remote authenticated attackers to execute arbitrary code in the server...
